Alerts - Get All

Reference

Service:: Monitor

API Version:: 2023-07-12-preview

List all existing alerts, where the results can be filtered on the basis of multiple parameters (e.g. time range). The results can then be sorted on the basis specific fields, with the default being lastModifiedDateTime.

GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?api-version=2023-07-12-preview

With optional parameters:

GET https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts?targetResource={targetResource}&targetResourceType={targetResourceType}&targetResourceGroup={targetResourceGroup}&monitorService={monitorService}&monitorCondition={monitorCondition}&severity={severity}&alertState={alertState}&alertRule={alertRule}&smartGroupId={smartGroupId}&includeContext={includeContext}&includeEgressConfig={includeEgressConfig}&pageCount={pageCount}&sortBy={sortBy}&sortOrder={sortOrder}&select={select}&timeRange={timeRange}&customTimeRange={customTimeRange}&api-version=2023-07-12-preview

URI Parameters

Name	In	Required	Type	Description
scope	path	True	string	scope here is resourceId for which alert is created.
api-version	query	True	string	The API version to use for this operation.
alertRule	query		string	Filter by specific alert rule. Default value is to select all.
alertState	query		AlertState	Filter by state of the alert instance. Default value is to select all.
customTimeRange	query		string	Filter by custom time range in the format / where time is in (ISO-8601 format)'. Permissible values is within 30 days from query time. Either timeRange or customTimeRange could be used but not both. Default is none.
includeContext	query		boolean	Include context which has contextual data specific to the monitor service. Default value is false'
includeEgressConfig	query		boolean	Include egress config which would be used for displaying the content in portal. Default value is 'false'.
monitorCondition	query		MonitorCondition	Filter by monitor condition which is either 'Fired' or 'Resolved'. Default value is to select all.
monitorService	query		MonitorService	Filter by monitor service which generates the alert instance. Default value is select all.
pageCount	query		integer int64	Determines number of alerts returned per page in response. Permissible value is between 1 to 250. When the "includeContent" filter is selected, maximum value allowed is 25. Default value is 25.
select	query		string	This filter allows to selection of the fields(comma separated) which would be part of the essential section. This would allow to project only the required fields rather than getting entire content. Default is to fetch all the fields in the essentials section.
severity	query		Severity	Filter by severity. Default value is select all.
smartGroupId	query		string	Filter the alerts list by the Smart Group Id. Default value is none.
sortBy	query		AlertsSortByFields	Sort the query results by input field, Default value is 'lastModifiedDateTime'.
sortOrder	query		SortOrder	Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.
targetResource	query		string	Filter by target resource( which is full ARM ID) Default value is select all.
targetResourceGroup	query		string	Filter by target resource group name. Default value is select all.
targetResourceType	query		string	Filter by target resource type. Default value is select all.
timeRange	query		TimeRange	Filter by time range by below listed values. Default value is 1 day.

Responses

Name	Type	Description
200 OK	alertsList	OK. Successfully listed alert objects.
Other Status Codes	errorResponse	Error response describing why the operation failed.

Examples

ListAlerts

Sample Request

HTTP

GET https://management.azure.com/subscriptions/1e3ff1c0-771a-4119-a03b-be82a51e232d/providers/Microsoft.AlertsManagement/alerts?api-version=2023-07-12-preview

Sample Response

Status code:: 200

{
  "nextLink": "https://management.azure.com:443/subscriptions/1e3ff1c0-771a-4119-a03b-be82a51e232d/providers/Microsoft.AlertsManagement/alerts?api-version=2018-05-05-preview&timeRange=1d&ctoken=%2bRID%3aPlwOAPHEGwB9UwEAAAAgCw%3d%3d%23RT%3a2%23TRC%3a500%23RTD%3aqtQyMDE4LTA2LTEyVDE1OjEyOjE1",
  "value": [
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "Acknowledged",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight",
          "targetResourceName": "servicedeskappinsight",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "23d6b2ce-8c54-468f-aff0-sd32aebb7e56",
          "smartGroupingReason": "Occurred frequently with other alerts",
          "alertRule": "https://servisdffsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z",
          "actionStatus": {
            "isSuppressed": false
          },
          "description": "description of the alert"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/9e261de7-c804-4b9d-9ebf-6f50fe350a9a/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    },
    {
      "properties": {
        "essentials": {
          "severity": "Sev3",
          "signalType": "Log",
          "alertState": "New",
          "monitorCondition": "Fired",
          "monitorService": "Application Insights",
          "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/cind/providers/microsoft.operationalinsights/workspaces/servicedeskwcus",
          "targetResourceName": "servicedeskwcus",
          "targetResourceGroup": "servicedeskresourcegroup",
          "targetResourceType": "components",
          "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
          "smartGroupId": "d1c49c89-ea95-4697-a299-c0f5ebac62f1",
          "smartGroupingReason": "Alerts that frequently occur together have been grouped.",
          "alertRule": "https://servicsdfsdf.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
          "startDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedDateTime": "2018-09-13T15:51:02Z",
          "lastModifiedUserName": "System",
          "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z",
          "actionStatus": {
            "isSuppressed": false
          },
          "description": "description of the alert"
        },
        "egressConfig": {},
        "context": {}
      },
      "id": "/subscriptions/9e261de7-c804-4b9d-9ebf-6f50fe350a9a/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
      "type": "Microsoft.AlertsManagement/alerts",
      "name": "cpu alert"
    }
  ]
}

Definitions

Name	Description
actionStatus	Action status
alert	An alert created in alert management service.
alertProperties	Alert property bag
alertsList	List the alerts.
AlertsSortByFields	Sort the query results by input field, Default value is 'lastModifiedDateTime'.
AlertState	Alert object state, which can be modified by the user.
errorResponse	An error response from the service.
errorResponseBody	Details of error response.
essentials	This object contains consistent fields across different monitor services.
MonitorCondition	Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.
MonitorService	Monitor service on which the rule(monitor) is set.
Severity	Severity of alert Sev0 being highest and Sev4 being lowest.
SignalType	The type of signal the alert is based on, which could be metrics, logs or activity logs.
SortOrder	Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.
TimeRange	Filter by time range by below listed values. Default value is 1 day.

actionStatus

Action status

Name	Type	Description
isSuppressed	boolean	Value indicating whether alert is suppressed.

alert

An alert created in alert management service.

Name	Type	Description
id	string	Azure resource Id
name	string	Azure resource name
properties	alertProperties	Alert property bag
type	string	Azure resource type

alertProperties

Alert property bag

Name	Type	Description
context	object	Information specific to the monitor service that gives more contextual details about the alert.
egressConfig	object	Config which would be used for displaying the data in portal.
essentials	essentials	This object contains consistent fields across different monitor services.

alertsList

List the alerts.

Name	Type	Description
nextLink	string	URL to fetch the next set of alerts.
value	alert[]	List of alerts

AlertsSortByFields

Sort the query results by input field, Default value is 'lastModifiedDateTime'.

Name	Type	Description
alertState	string
lastModifiedDateTime	string
monitorCondition	string
name	string
severity	string
startDateTime	string
targetResource	string
targetResourceGroup	string
targetResourceName	string
targetResourceType	string

AlertState

Alert object state, which can be modified by the user.

Name	Type	Description
Acknowledged	string
Closed	string
New	string

errorResponse

An error response from the service.

Name	Type	Description
error	errorResponseBody	Details of error response.

errorResponseBody

Details of error response.

Name	Type	Description
code	string	Error code, intended to be consumed programmatically.
details	errorResponseBody[]	A list of additional details about the error.
message	string	Description of the error, intended for display in user interface.
target	string	Target of the particular error, for example name of the property.

essentials

This object contains consistent fields across different monitor services.

Name	Type	Description
actionStatus	actionStatus	Action status
alertRule	string	Rule(monitor) which fired alert instance. Depending on the monitor service, this would be ARM id or name of the rule.
alertState	AlertState	Alert object state, which can be modified by the user.
description	string	Alert description.
lastModifiedDateTime	string	Last modification time(ISO-8601 format) of alert instance.
lastModifiedUserName	string	User who last modified the alert, in case of monitor service updates user would be 'system', otherwise name of the user.
monitorCondition	MonitorCondition	Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.
monitorConditionResolvedDateTime	string	Resolved time(ISO-8601 format) of alert instance. This will be updated when monitor service resolves the alert instance because the rule condition is no longer met.
monitorService	MonitorService	Monitor service on which the rule(monitor) is set.
severity	Severity	Severity of alert Sev0 being highest and Sev4 being lowest.
signalType	SignalType	The type of signal the alert is based on, which could be metrics, logs or activity logs.
smartGroupId	string	Unique Id of the smart group
smartGroupingReason	string	Verbose reason describing the reason why this alert instance is added to a smart group
sourceCreatedId	string	Unique Id created by monitor service for each alert instance. This could be used to track the issue at the monitor service, in case of Nagios, Zabbix, SCOM etc.
startDateTime	string	Creation time(ISO-8601 format) of alert instance.
targetResource	string	Target ARM resource, on which alert got created.
targetResourceGroup	string	Resource group of target ARM resource, on which alert got created.
targetResourceName	string	Name of the target ARM resource name, on which alert got created.
targetResourceType	string	Resource type of target ARM resource, on which alert got created.

MonitorCondition

Condition of the rule at the monitor service. It represents whether the underlying conditions have crossed the defined alert rule thresholds.

Name	Type	Description
Fired	string
Resolved	string

MonitorService

Monitor service on which the rule(monitor) is set.

Name	Type	Description
ActivityLog Administrative	string
ActivityLog Autoscale	string
ActivityLog Policy	string
ActivityLog Recommendation	string
ActivityLog Security	string
Application Insights	string
Log Analytics	string
Nagios	string
Platform	string
Resource Health	string
SCOM	string
ServiceHealth	string
SmartDetector	string
VM Insights	string
Zabbix	string

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

Name	Type	Description
Sev0	string
Sev1	string
Sev2	string
Sev3	string
Sev4	string

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

Name	Type	Description
Log	string
Metric	string
Unknown	string

SortOrder

Sort the query results order in either ascending or descending. Default value is 'desc' for time fields and 'asc' for others.

Name	Type	Description
asc	string
desc	string

TimeRange

Filter by time range by below listed values. Default value is 1 day.

Name	Type	Description
1d	string
1h	string
30d	string
7d	string